novoads-api
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill follows established best practices for handling API keys.
- [DATA_EXFILTRATION]: Network requests are directed to the official vendor domain (api.novoads.ai). The skill correctly instructs users to store secrets in a .env file and warns against exposing them in logs or chat.
- [COMMAND_EXECUTION]: The skill uses legitimate system utilities such as ffmpeg, ffprobe, and curl. These tools are used for their intended purposes: extracting metadata, processing frames, and interacting with the REST API.
- [EXTERNAL_DOWNLOADS]: Mentions dependencies on trusted tools like Homebrew (ffmpeg) and OpenAI's Whisper (openai-whisper). These are well-known services and do not escalate the risk profile.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided media files (video/images) for analysis and cloning. This involves an inherent indirect prompt injection surface; however, the skill provides extensive documentation for output verification (Video QA) to detect and mitigate potential anomalies.
Audit Metadata